net/tls: Fix tls_sk_proto_close Executed Repeatedly in Linux Kernel
Summary
GSD-2022-1004468: net/tls: fix tls_sk_proto_close executed repeatedly. Affects Kernel versions >= 95fa145479fbc0a0c1fd3274ceb42ec03c042a4a, < be64f54a0db2dbf399f3bca45458d06c833641f0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources, facilitating communication between hardware and software components, and enforcing security policies. The net/tls module within the Linux Kernel is responsible for implementing Transport Layer Security (TLS) protocols for network communication. TLS is crucial for securing data transmission over networks, ensuring confidentiality, integrity, and authentication. However, a vulnerability has been discovered in the net/tls module that allows the tls_sk_proto_close function to be executed repeatedly, leading to potential security issues.
Vulnerability Detail
The vulnerability in the net/tls module arises from a flaw in the tls_sk_proto_close function. When this function is called multiple times, it can result in unintended consequences and security risks. The exact impact and attack vectors of this vulnerability have not been proven yet, but it has the potential to compromise the security and stability of TLS connections. The vulnerability was introduced in Linux Kernel version 5.3 and has been fixed in version 5.15.51 by commit be64f54a0db2dbf399f3bca45458d06c833641f0.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version 5.15.51 or later. This can be done by obtaining the latest kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it for the target system. Alternatively, users can wait for their Linux distribution to provide an updated kernel package that includes the fix.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the net/tls module if it is not essential for their system's functionality. This can be achieved by modifying the kernel configuration and excluding the net/tls module from the build. However, this workaround should only be considered if the module is not actively used, as it may impact the functionality of TLS-based network communication.
Conclusion
The net/tls vulnerability in the Linux Kernel's net/tls module can lead to potential security risks and compromise the integrity of TLS connections. It is crucial to update the kernel to version 5.15.51 or later to fix this vulnerability. Alternatively, users can disable the net/tls module if it is not actively used. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/tls module in the Linux Kernel is responsible for implementing Transport Layer Security (TLS) protocols for network communication. It enables secure data transmission over networks by providing encryption, integrity, and authentication mechanisms.
The exact impact of the net/tls vulnerability is not yet proven, but it has the potential to compromise the security and stability of TLS connections. Attackers may be able to exploit this vulnerability to gain unauthorized access, tamper with data, or perform other malicious activities.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Yes, a patch for this vulnerability is available in Linux Kernel version 5.15.51. It is recommended to update the kernel to this version or later to mitigate the vulnerability.
Yes, as a workaround, you can disable the net/tls module if it is not essential for your system's functionality. However, this should only be considered if the module is not actively used, as it may impact the functionality of TLS-based network communication.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.